CVE-2026-33510
Published: 06 April 2026
Summary
CVE-2026-33510 is a high-severity Improper Neutralization of Alternate XSS Syntax (CWE-87) vulnerability in Homarr Homarr. Its CVSS base score is 8.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 14.0th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-15 (Information Output Filtering).
Deeper analysis
CVE-2026-33510 is a DOM-based Cross-Site Scripting (XSS) vulnerability affecting Homarr, an open-source dashboard, in versions prior to 1.57.0. The issue resides in the /auth/login page, where the application improperly trusts the callbackUrl URL parameter and passes it directly to redirect and router.push functions without proper sanitization. This flaw is associated with CWE-87 (Improper Neutralization of Special Elements used in an XSS Attack) and CWE-601 (URL Redirection to Untrusted Site ('Open Redirect')).
An unauthenticated attacker (PR:N) can exploit this vulnerability over the network (AV:N) with low complexity (AC:L) by crafting a malicious link containing a payload in the callbackUrl parameter. The attack requires user interaction (UI:R), such as an authenticated victim clicking or opening the link, which triggers a client-side redirect and executes arbitrary JavaScript in the victim's browser context with changed scope (S:C). Successful exploitation can result in high confidentiality impact (C:H), such as credential theft, along with low integrity (I:L) and availability (A:L) impacts, including internal network pivoting and unauthorized actions on the victim's behalf. The CVSS v3.1 base score is 8.8.
The vulnerability has been fixed in Homarr version 1.57.0. Security practitioners should upgrade to this version or later. Additional details are available in the GitHub security advisory at https://github.com/homarr-labs/homarr/security/advisories/GHSA-79pg-554g-rw82.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-19287
Vulnerability details
Homarr is an open-source dashboard. Prior to 1.57.0, a DOM-based Cross-Site Scripting (XSS) vulnerability has been discovered in Homarr's /auth/login page. The application improperly trusts a URL parameter (callbackUrl), which is passed to redirect and router.push. An attacker can craft…
more
a malicious link that, when opened by an authenticated user, performs a client-side redirect and executes arbitrary JavaScript in the context of their browser. This could lead to credential theft, internal network pivoting, and unauthorized actions performed on behalf of the victim. This vulnerability is fixed in 1.57.0.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
DOM-based XSS in public-facing Homarr login page directly enables exploitation of the exposed web app (T1190) and arbitrary JavaScript execution in the victim's browser via the unsanitized callbackUrl parameter (T1059.007).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Requires validation and sanitization of the untrusted callbackUrl parameter to prevent injection of malicious JavaScript payloads leading to DOM-based XSS.
Mandates filtering of output prior to client-side processing in redirect and router.push functions to neutralize XSS payloads.
Ensures timely remediation of the specific flaw through patching to version 1.57.0 or later, eliminating the vulnerability.